Solana
Hidden instructions and spoofed previews
A Solana transaction can carry many instructions. Drainers hide transfers among them, or make the preview look harmless, so you approve a sweep you never saw.
How it works
One Solana transaction can bundle several instructions: a real swap plus a transfer of your SOL and tokens to the attacker, for example.
Some drainers detect simulation and behave differently when your wallet previews the transaction than when it lands, or they use accounts that change state between preview and execution.
Wallet security warnings catch many of these, so the drainer page will often tell you to ignore the warning.
Red flags
- A wallet warning that the transaction 'could not be simulated' or 'may be malicious'
- A site telling you to ignore or switch off security warnings
- Far more instructions or accounts than the action needs
Protect yourself
- Treat a failed or odd simulation as a hard stop
- Use wallets with transaction scanning switched on
- Interact with new sites from a burner wallet holding only what you need
If you already signed
- Move remaining funds to a fresh wallet
- Revoke any token delegates the transaction set
- Report the site to your wallet
Incidents using it 0
None tracked yet.